pyca/bcrypt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixes #416 -- correctly handle invalid salts (#417)

Browse Source
This commit is contained in:
Alex Gaynor 2022-09-16 10:22:40 -04:00 committed by GitHub
parent cd4229d64c
commit e1ed0f46ca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/_bcrypt/src/lib.rs
View File

@ -49,7 +49,9 @@ fn hashpass<'p>(
.try_into()
.map_err(|_| pyo3::exceptions::PyValueError::new_err("Invalid salt"))?;
let hashed = py.allow_threads(|| bcrypt::hash_with_salt(password, cost, raw_salt).unwrap());
let hashed = py
.allow_threads(|| bcrypt::hash_with_salt(password, cost, raw_salt))
.map_err(|_| pyo3::exceptions::PyValueError::new_err("Invalid salt"))?;
Ok(pyo3::types::PyBytes::new(
py,
hashed.format_for_version(version).as_bytes(),

5
tests/test_bcrypt.py
View File

@ -272,6 +272,11 @@ def test_checkpw_bad_salt():
b"badpass",
b"$2b$04$?Siw3Nv3Q/gTOIPetAyPr.GNj3aO0lb1E5E9UumYGKjP9BYqlNWJe",
)
with pytest.raises(ValueError):
bcrypt.checkpw(
b"password",
b"$2b$3$mdEQPMOtfPX.WGZNXgF66OhmBlOGKEd66SQ7DyJPGucYYmvTJYviy",
)
def test_checkpw_str_password():